fix(007-mcp): add missing ToolRisk enum to Zig FFI (ABI drift, standards#92) (#102)

## Summary

Surfaced by the Phase 2 ABI drift gate spot-check (iseriser/PR #14):
`Oo7Mcp.SafeCli.ToolRisk` (5 tiers, `tierToInt` encoding 0–4) is
declared in the Idris2 ABI but absent from `oo7_mcp_ffi.zig`. Adds the
matching `pub const ToolRisk = enum(c_int)` with the encoding verified
by `iseriser abi-verify` (exit 0 after this fix; was DRIFT before).

## Scope

ABI parity only. Risk-tier *enforcement* (`categoryDefaultRisk` /
`riskPromotion` from SafeCli) is currently Idris2-only — the Zig
dispatcher does not yet gate on this enum. Wiring risk gates into the
dispatcher is a separate follow-up; this PR keeps the change minimal so
the Phase 2 gate can promote 007-mcp to its allowlist.

## Before / After

```
$ iseriser abi-emit-manifest --idris cartridges/007-mcp/abi/Oo7Mcp/SafeCli.idr \
    --cartridge 007-mcp --source-path SafeCli.idr --out /tmp/007.json
abi-emit-manifest: wrote /tmp/007.json (2 enums, 0 transitions)

$ iseriser abi-verify --manifest /tmp/007.json \
    --zig-ffi cartridges/007-mcp/ffi/oo7_mcp_ffi.zig
# BEFORE: [enum-missing-in-zig] manifest declares enum `ToolRisk` but the Zig FFI has no `pub const ToolRisk = enum(c_int)` declaration
# AFTER:  abi-verify: OK — cartridge `007-mcp` ABI manifest agrees with `…/oo7_mcp_ffi.zig`
```

## Test plan

- [x] `iseriser abi-verify` → exit 0
- [x] `zig build test` (cartridges/007-mcp/ffi/) → 8/8 green
- [ ] reviewer: confirm the documentation in the new enum's
block-comment is accurate (mirrors `SafeCli.idr` lines 150-169 — 5
tiers, Tier 4 reserved-only-not-used)

Refs hyperpolymath/standards#92
Refs hyperpolymath/standards#89

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

cartridges/007-mcp/ffi/oo7_mcp_ffi.zig

@@ -51,6 +51,29 @@ pub const SessionState = enum(c_int) {
     degraded = 4,
 };
 
+// ═══════════════════════════════════════════════════════════════════════
+// Tool risk tier (matches Oo7Mcp.SafeCli.ToolRisk + tierToInt encoding)
+// ═══════════════════════════════════════════════════════════════════════
+//
+// Tier 0 — pure read (status, list)
+// Tier 1 — logged (runtime reads, tests, builds, lint)
+// Tier 2 — light gate (container builds, docs generate, heal)
+// Tier 3 — hard gate (rollback, destructive clean, container-run w/ privileged)
+// Tier 4 — forbidden for supervised role (none on 007-mcp; reserved)
+//
+// Declared here so iseriser's `abi-verify` can check the encoding stays
+// in sync with `SafeCli.ToolRisk`. Risk enforcement (categoryDefaultRisk
+// / riskPromotion) is currently Idris2-only — the Zig dispatcher does
+// not yet gate on this enum; wiring is a separate follow-up.
+
+pub const ToolRisk = enum(c_int) {
+    tier0 = 0,
+    tier1 = 1,
+    tier2 = 2,
+    tier3 = 3,
+    tier4 = 4,
+};
+
 /// Session-wide state. Single-instance per adapter process.
 var g_state: SessionState = .fresh;
 var g_state_mu: std.Thread.Mutex = .{};